Fix ReDoS in the SVG parser, clean up ESLint and SonarJS findings

ESLint (typescript-eslint strict type-checked) with SonarJS, knip and a
regex timing harness over every regular expression of src:

- svg.ts: regular expressions that backtracked on hostile input are
  replaced: the stylesheet (blocks and comments) is scanned with
  indexOf, url() references by a small scanner, numbers use a pattern
  whose alternatives can't match the same digits twice, colors and
  lengths are trimmed instead of matching spaces twice. A 200,000
  character style without braces took 60 s, url(#a followed by spaces
  was exponential; all of them take a few ms now (regression tests).
  The 1952 sample SVGs render the same; an unclosed style rule at the
  end applies now, like in browsers
- types: the TIFF tags, quantizer lookup and SVG arrays are typed
  (no any), Shaper hooks are function properties (no unbound methods),
  redundant assertions removed
- layout.ts: one coverage list helper for contexts and reverse
  chaining; text.ts, buffer.ts, machine.ts: unused helpers removed
- one statement per line where single-line blocks read like bugs
  (vp8.ts, hinting.ts), substr -> slice, prefer-const

The remaining findings are style (cognitive complexity, nested
ternaries, const enum comparisons) or defensive checks TypeScript
considers impossible (index lookups, input from JavaScript callers).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJgRK5qpwJEbHPuFv6kgAQ

Author: matmen

CHANGELOG.md

@@ -70,6 +70,10 @@
 
 ### Fixes
 
+- `Image.renderSVG`: SVGs with long malformed styles, `url()` references, lengths or colors (e.g. a stylesheet of
+  200,000 characters without braces, which took a minute) parse in linear time instead of backtracking quadratically
+  or worse in regular expressions. A style rule that isn't closed at the end of the stylesheet applies now, as in
+  browsers.
 - NaN and infinite arguments throw a RangeError naming the argument instead of silently drawing black, transparent
   or nothing: colors (`fill`, `setPixelAt`, `drawBox`, `drawCircle`, `trim`, `colorToAlpha`, `Image.gradient`, the
   text and stroke colors, `Image.rgbaToColor` and the other color conversions, so `Image.rgbToColor(NaN, 0, 0)` is no

src/codecs/png.ts

@@ -729,7 +729,7 @@ function hexProfile(text: string): Uint8Array {
     if (!match) return new Uint8Array(0);
     const digits = match[2].replace(/\s+/g, '');
     const out = new Uint8Array(Math.min(+match[1], digits.length >> 1));
-    for (let i = 0; i < out.length; i++) out[i] = parseInt(digits.substr(i * 2, 2), 16);
+    for (let i = 0; i < out.length; i++) out[i] = parseInt(digits.slice(i * 2, i * 2 + 2), 16);
     return out;
 }
 

src/codecs/quantize.ts

@@ -98,7 +98,7 @@ export function quantize(pixels: Uint8Array, width: number, { maxColors = 256, q
 
 // returns an exact palette if the opaque pixels use at most `limit` distinct colors
 function exactPalette(pixels: Uint8Array, limit: number): { palette: Uint8Array, indices: Uint8Array } | null {
-    const lookup = new Map();
+    const lookup = new Map<number, number>();
     const indices = new Uint8Array(pixels.length >> 2);
     const palette: number[] = [];
 

src/codecs/tiff.ts

@@ -71,7 +71,7 @@ export async function decode(data: Uint8Array, maxPixels = MAX_PIXELS): Promise<
     if (ifdOffset + 2 > data.length) throw new Error('TIFF: invalid IFD offset');
 
     // read the first IFD
-    const tags = new Map();
+    const tags = new Map<number, { type: number, count: number, offset: number }>();
     const entryCount = big ? u64(ifdOffset) : u16(ifdOffset);
     const entrySize = big ? 20 : 12;
     const inlineSize = big ? 8 : 4;
@@ -188,7 +188,8 @@ export async function decode(data: Uint8Array, maxPixels = MAX_PIXELS): Promise<
 
     // JPEG compressed segments decode straight to RGBA
     if (compression === 7) {
-        const tables = tags.has(TAGS.JPEGTables) ? data.subarray(tags.get(TAGS.JPEGTables).offset, tags.get(TAGS.JPEGTables).offset + tags.get(TAGS.JPEGTables).count) : null;
+        const jpegTables = tags.get(TAGS.JPEGTables);
+        const tables = jpegTables ? data.subarray(jpegTables.offset, jpegTables.offset + jpegTables.count) : null;
         const transform = photometric === 6 ? 'ycc' : photometric === 2 ? 'rgb' : photometric === 5 ? 'cmyk' : null;
 
         for (let s = 0; s < segmentsPerPlane; s++) {

src/codecs/vp8.ts

@@ -474,8 +474,15 @@ function predictBlock(mode: number, p: Uint8Array, base: number, stride: number,
     if (mode === DC_PRED) {
         const shift = size === 16 ? 3 : 2;
         let sum = 0, count = 0;
-        if (mby > 0) { for (let i = 0; i < size; i++) sum += p[above + i]; count++; }
-        if (mbx > 0) { for (let i = 0; i < size; i++) sum += p[base + i * stride - 1]; count++; }
+        // (the edges above and left that exist)
+        if (mby > 0) {
+            for (let i = 0; i < size; i++) sum += p[above + i];
+            count++;
+        }
+        if (mbx > 0) {
+            for (let i = 0; i < size; i++) sum += p[base + i * stride - 1];
+            count++;
+        }
         const v = count === 0 ? 128 : sum + (1 << shift + count - 1) >> shift + count;
         for (let y = 0; y < size; y++) p.fill(v, base + y * stride, base + y * stride + size);
     } else if (mode === V_PRED) {

src/codecs/zlib.ts

@@ -110,7 +110,7 @@ function inflate(dat: Uint8Array, buf: Uint8Array): Uint8Array {
     let final = 0, pos = 0, bt = 0;
 
     do {
-        let lm: Uint16Array, dm: Uint16Array | null = null, lbt: number, dbt = 0;
+        let lm: Uint16Array, dm: Uint16Array, lbt: number, dbt: number;
         // a block's header (every block is decoded to its end before the next one)
         final = bits(dat, pos, 1);
         const type = bits(dat, pos + 1, 3);
@@ -191,7 +191,7 @@ function inflate(dat: Uint8Array, buf: Uint8Array): Uint8Array {
                     pos += b;
                 }
 
-                const d = (dm as Uint16Array)[bits16(dat, pos) & dms], dsym = d >> 4;
+                const d = dm[bits16(dat, pos) & dms], dsym = d >> 4;
                 if (!d) throw new Error('zlib: invalid distance');
                 pos += d & 15;
 

src/image.ts

@@ -1749,10 +1749,10 @@ export class Image {
         const gradients: Array<{ min: number, max: number, gradient: (position: number) => Color }> = [];
 
         for (let i = 0; i < positions.length; i++) {
-            let minPos = positions[i - 1];
+            const minPos = positions[i - 1];
             if (minPos === undefined) continue;
 
-            let maxPos = positions[i];
+            const maxPos = positions[i];
 
             let minVal = values[i - 1];
             if (minVal === undefined) minVal = values[i];

src/render/buffer.ts

@@ -9,7 +9,6 @@ export const enum GlyphProps {
     BASE = 0x02,
     LIGATURE = 0x04,
     MARK = 0x08,
-    CLASS_MASK = BASE | LIGATURE | MARK,
     SUBSTITUTED = 0x10,
     LIGATED = 0x20,
     MULTIPLIED = 0x40,
@@ -384,8 +383,6 @@ export const isContinuation = (info: GlyphInfo): boolean => (info.unicodeProps &
 const isFormat = (info: GlyphInfo): boolean => generalCategory(info) === Category.Cf;
 export const isZWNJ = (info: GlyphInfo): boolean => isFormat(info) && (info.unicodeProps & UnicodeProps.ZWNJ) !== 0;
 export const isZWJ = (info: GlyphInfo): boolean => isFormat(info) && (info.unicodeProps & UnicodeProps.ZWJ) !== 0;
-export const isJoiner = (info: GlyphInfo): boolean => isFormat(info) && (info.unicodeProps & (UnicodeProps.ZWJ | UnicodeProps.ZWNJ)) !== 0;
-export const isVariationSelector = (info: GlyphInfo): boolean => isFormat(info) && (info.unicodeProps & UnicodeProps.VS) !== 0;
 
 export const IS_LIG_BASE = 0x10;
 export const ligId = (info: GlyphInfo): number => info.ligProps >> 5;

src/render/hinting.ts

@@ -777,8 +777,16 @@ class Execution {
                         break;
                     case 0x59: break; // EIF
                     case 0x1c: next = ip + this.pop(); break; // JMPR
-                    case 0x78: { const e = this.pop(), offset = this.pop(); if (e) next = ip + offset; break; } // JROT
-                    case 0x79: { const e = this.pop(), offset = this.pop(); if (!e) next = ip + offset; break; } // JROF
+                    case 0x78: { // JROT
+                        const e = this.pop(), offset = this.pop();
+                        if (e) next = ip + offset;
+                        break;
+                    }
+                    case 0x79: { // JROF
+                        const e = this.pop(), offset = this.pop();
+                        if (!e) next = ip + offset;
+                        break;
+                    }
                     case 0x2c: case 0x89: { // FDEF, IDEF
                         const n = this.pop();
                         let p = next;
@@ -863,8 +871,12 @@ class Execution {
                         const mv = this.moveVector();
                         const dx = d * mv.x, dy = d * mv.y;
                         const shift = (z: Zone, p: number, touch: boolean): void => {
-                            z.curX[p] += dx; z.curY[p] += dy;
-                            if (touch) { if (gs.fv.x !== 0) z.touchX[p] = 1; if (gs.fv.y !== 0) z.touchY[p] = 1; }
+                            z.curX[p] += dx;
+                            z.curY[p] += dy;
+                            if (touch) {
+                                if (gs.fv.x !== 0) z.touchX[p] = 1;
+                                if (gs.fv.y !== 0) z.touchY[p] = 1;
+                            }
                         };
 
                         if (op <= 0x33) { // SHP

src/render/layout.ts

@@ -743,13 +743,7 @@ export class LayoutTable {
         }
 
         if (format === 3) {
-            // coverages as offsets, matched by index into a list of tests
-            const tests: Array<(glyph: number) => boolean> = [];
-            const coverages = (o: number, count: number): number[] => Array.from({ length: count }, (_, j) => {
-                tests.push(covered(f, offset + f.u16(o + j * 2)));
-                return tests.length - 1;
-            });
-            const matchCoverage: MatchFunc = (info, value) => tests[value](info.codepoint);
+            const { coverages, matchCoverage, tests } = coverageList(f, offset);
             let r: Rule, first: number;
             if (!chained) {
                 const inputCount = f.u16(offset + 2), recordCount = f.u16(offset + 4);
@@ -890,18 +884,13 @@ export class LayoutTable {
                 // reverse chaining single
                 case 8: {
                     const backtrackCount = f.u16(offset + 4);
-                    const tests: Array<(glyph: number) => boolean> = [];
-                    const list = (o: number, count: number): number[] => Array.from({ length: count }, (_, j) => {
-                        tests.push(covered(f, offset + f.u16(o + j * 2)));
-                        return tests.length - 1;
-                    });
+                    const { coverages: list, matchCoverage } = coverageList(f, offset);
                     const backtrack = list(offset + 6, backtrackCount);
                     let p = offset + 6 + backtrackCount * 2;
                     const lookaheadCount = f.u16(p);
                     const lookahead = list(p + 2, lookaheadCount);
                     p += 2 + lookaheadCount * 2;
                     const substituteCount = f.u16(p), substitutes = p + 2;
-                    const matchCoverage: MatchFunc = (info, value) => tests[value](info.codepoint);
                     return { coverage: has, would: single, apply: c => {
                         const index = coverage(c.buffer.cur().codepoint);
                         if (index < 0) return false;
@@ -1176,6 +1165,17 @@ export function applySynthetic(buffer: Buffer, gdef: GDEF, l: Lookup, mask: numb
     applyString(c, l, 0);
 }
 
+// coverage tables of a subtable (offsets from it) as numbered tests for the matching of contexts: coverages() reads a
+// list of offsets and returns their numbers, matchCoverage() matches a glyph against a number
+function coverageList(f: Font, subtable: number): { coverages: (o: number, count: number) => number[], matchCoverage: MatchFunc, tests: Array<(glyph: number) => boolean> } {
+    const tests: Array<(glyph: number) => boolean> = [];
+    const coverages = (o: number, count: number): number[] => Array.from({ length: count }, (_, j) => {
+        tests.push(covered(f, subtable + f.u16(o + j * 2)));
+        return tests.length - 1;
+    });
+    return { coverages, matchCoverage: (info, value) => tests[value](info.codepoint), tests };
+}
+
 const values16 = (f: Font, o: number, count: number): number[] => Array.from({ length: count }, (_, j) => f.u16(o + j * 2));
 
 // the most bits a feature's value takes (HB_OT_MAP_MAX_BITS)
@@ -1501,16 +1501,16 @@ export class MapBuilder {
     }
 
     hasFeature(tag: string): boolean {
-        return [0, 1].some(t => this.tables[t] && (this.tables[t] as LayoutTable).langSysFeatures(this.langSys[t]).features.has(tag));
+        return [0, 1].some(t => this.tables[t]?.langSysFeatures(this.langSys[t]).features.has(tag));
     }
 
     compile(): OTMap {
         const m = new OTMap();
         m.chosenScript = [...this.chosenScript] as [string, string];
         m.foundScript = [...this.foundScript] as [boolean, boolean];
 
-        const langSys = [0, 1].map(t => this.tables[t] ? (this.tables[t] as LayoutTable).langSysFeatures(this.langSys[t]) : { required: -1, features: new Map<string, number>() });
-        const requiredTag = [0, 1].map(t => langSys[t].required >= 0 && this.tables[t] ? (this.tables[t] as LayoutTable).featureTag(langSys[t].required) : '');
+        const langSys = [0, 1].map(t => this.tables[t]?.langSysFeatures(this.langSys[t]) ?? { required: -1, features: new Map<string, number>() });
+        const requiredTag = [0, 1].map(t => langSys[t].required >= 0 ? this.tables[t]?.featureTag(langSys[t].required) ?? '' : '');
         const requiredStage = [0, 0];
 
         // sort the features and merge duplicates
@@ -1556,7 +1556,7 @@ export class MapBuilder {
                 }
             }
             if (!found && info.flags & FeatureFlags.GLOBAL_SEARCH) for (const t of [0, 1]) {
-                const i = this.tables[t] ? (this.tables[t] as LayoutTable).findFeature(info.tag) : -1;
+                const i = this.tables[t]?.findFeature(info.tag) ?? -1;
                 if (i >= 0) {
                     index[t] = i;
                     found = true;